Three failed tries at 3 a.m.
Somebody tries to sign in to a server at 3 a.m. They fail three times. Nobody is awake. Did anyone notice?
A detective control notices. It does not stop the attacker. It spots them, now or later, so people can act.
Key words
| Word | What it means |
|---|---|
| Detective control | A control that finds an incident while it happens, or afterwards. |
| Incident | A bad event, such as a break-in, a fire or a leak of data. |
| CCTV | Closed-circuit television: cameras that send video to screens or a recorder. |
| Motion sensor | A device that detects movement in a room. |
| Log | A written record of events with the time they happened. |
| Audit | A check of records and actions to see if the rules were followed. |
| Review | Looking back over logs or records to find problems. |
| Server | A computer that gives data or services to other computers. |
The cells students fill in are left blank in this preview.
By the end of this lesson
Note
I can name the physical and written detective controls and say what each one finds.
Starter: what you already know
Have a go
Starter: what you already know
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
Cycle 1: physical detectors
CCTV records who was at a door or in a room. A person can watch it live, or you can review it later.
A motion sensor notices movement in a room that should be empty, such as a server room at night. It can set off an alarm or send a message.
Both let you find out that something happened.
Cycle 2: records and checks
A log is a record of events. Servers write error logs and sign-in logs. A sensor can write a temperature log for the server room. A door system writes who entered and when.
A review or audit reads the records. For example, check each week who entered and left the building. Look for strange times, strange people and repeated failures.
Detective controls and what they find
| Control | What it finds | In progress or after? |
|---|---|---|
| CCTV | Who was at the door | Both: live watching and later review |
| Motion sensor | Movement in an empty room | In progress |
| Error log | A fault on a server | After, and sometimes live |
| Temperature log | A server room getting too hot | Both |
| Entry and exit review | A visitor who never left | After |
The cells students fill in are left blank in this preview.
Check: detect it
Have a go
Check: detect it
4 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.